# SC-067v3: MPIC, domain validation from multiple networks

> SC-067v3 requires Multi-Perspective Issuance Corroboration (MPIC): domain validation and CAA checks repeated from several networks, phased in from 2025 to 2026.

Source: https://ssl.sh/ballots/sc-067/
Last updated: 2026-11-10

SC-067v3 requires every publicly trusted TLS CA to repeat its domain control and [CAA](https://ssl.sh/glossary/caa/) checks from several remote "network perspectives", in addition to its own data center, before issuing a certificate. This is called [Multi-Perspective Issuance Corroboration (MPIC)](https://ssl.sh/glossary/mpic/); it became mandatory on 2025-03-15 and gets stricter in steps until 2026-12-15.

## What changed

SC-067v3 added §3.2.2.9 to the [Baseline Requirements](https://ssl.sh/glossary/baseline-requirements/). The CA's primary perspective validates as before; remote perspectives then repeat the HTTP, DNS or TLS-ALPN check and the CAA lookup, and must agree. Remote perspectives may not share a DNS cache with each other, and from 2026 they must sit in at least two Regional Internet Registry regions. The motivation in the ballot: attackers have used BGP hijacks to fool domain validation and obtain certificates for sites they didn't control, and localized hijacks are hard to stop with routing security alone.

## Effective dates

The BR text took effect on 2024-09-06. From 2025-03-15 CAs had to run MPIC with at least 2 remote perspectives but could still issue on a mismatch; from 2025-09-15 the quorum is enforced. The minimum then rises to 3 perspectives (2026-03-15), 4 (2026-06-15) and 5 (2026-12-15). With 2–5 perspectives one non-corroboration is allowed, with 6 or more two. As of November 2026 the 4-perspective stage applies.

## Who is affected

CAs had to build or buy distributed validation. Site owners notice it when their validation endpoint isn't reachable from everywhere: a firewall or geo-blocking that only allows certain countries, or DNS that answers differently by location, can now make issuance fail.

## What to do

Make sure `/.well-known/acme-challenge/` and your authoritative DNS answer the same way worldwide. If you restrict access by country or IP range, exempt the validation path or switch to [DNS-01](https://ssl.sh/glossary/dns-01/). See the [CAA guide](https://ssl.sh/learn/caa-records/) for the other check MPIC repeats.


| Field | Value |
|---|---|
| Ballot | SC-067v3 |
| Status | Passed |
| Adopted | 2024-08-02 |
| Effective | 2024-09-06 |
| BR version | 2.0.7 |
| Official page | https://cabforum.org/2024/08/05/ballot-sc067v3-require-domain-validation-and-caa-checks-to-be-performed-from-multiple-network-perspectives-corroboration/ |